[RESOLVED] help with securing admin pages

fearfx · Sep 18, 2007

Ok I have my admin system and my login area. When I login successfully It sets a cookie.

Now to make sure my admin pages are secure and can't be accessed by just typing in a url.

Now I have this code to check to see if the cookie was set, but It doesn't work the way I would like it to.

<?php

if (!isset($_COOKIE['admin'])) {
	header ("Location: login.php");
}
?>

Now after that block of code I have the rest of my admin page code.

Any clues how to proceed?

fearfx · Sep 18, 2007

any reason why my post is being ignored?

fearfx · Sep 18, 2007

ok maybe I should clarify more..

this is my index.php default page code...

<?php

if (!isset($_COOKIE['admin'])) {
	header ("Location: login.php");
} else { // if session else management
	header ("Location: main.php");
	}
?>

now I can use this code on main.php but I obviously don't want to redirect again.

So what can I do, when main.php is accessed, check if the admin is logged in and then if the admin is logged in show this block of code...

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html xml:lang="tr" lang="tr" xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" /> 
<title><?php echo $site_name; ?> | Control Panel</title>
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Cache-Control" content="no-cache" />
<link rel="shortcut icon" href="favicon.ico" />
<style type='text/css' media="all">@import url("index.css");</style>
<script language="javascript">
	function onay() { return confirm("Are you sure?"); }
</script>
</head>
<body style='background-image: url(images/blank.gif)'align'center'>
<div 
style="BORDER-RIGHT: #dddddd 1px solid; PADDING-RIGHT: 8px; BORDER-TOP: #dddddd 1px solid; PADDING-LEFT: 8px; PADDING-BOTTOM: 8px; MARGIN: 0px; BORDER-LEFT: #dddddd 1px solid; WIDTH: 990px; PADDING-TOP: 8px; BORDER-BOTTOM: #dddddd 1px solid; BACKGROUND-COLOR: #ffffff">
  <div>
    <div align="center">
      <table width="100%" border="0" align="center" cellpadding="0" cellspacing="0">
        <tbody>
          <tr>
            <td valign="top" nowrap="nowrap" align="middle"><table style="BACKGROUND-COLOR: #cccccc" cellspacing="1" cellpadding="0" 
      width="150" border="0">
              <tbody>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="General Pages" 
          onclick="window.parent.document.location.href='index.php?act=general_pages';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> General Pages </td>
                </tr>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="Event Manager" 
          onclick="window.parent.document.location.href='index.php?act=event_manager';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> Event Manager </td>
                </tr>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="Calendar Managers" 
          onclick="window.parent.document.location.href='index.php?act=managers';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> Edit 
                    Admins </td>
                </tr>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="Edit Members" 
          onclick="window.parent.document.location.href='index.php?act=event_members';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> Edit 
                    Members </td>
                </tr>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="Business Directory" 
          onclick="window.parent.document.location.href='edit_business/';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> Business Directory </td>
                </tr>
                <tr>
                  <td class="Menu_Norm" onmouseover="this.className = 'Menu_Over';" 
          title="Edit Members" 
          onclick="window.parent.document.location.href='index.php?act=metrics';" 
          onmouseout="this.className = 'Menu_Norm';" valign="center" 
            align="left"><img 
            src="images/bullet.gif" width="7" height="5" 
            style="PADDING-RIGHT: 2px; PADDING-LEFT: 3px; VERTICAL-ALIGN: middle" /> Metrics </td>
                </tr>
              </tbody>
            </table></td>
            <td style="PADDING-LEFT: 8px" valign="top" align="left" width="100%"><div style="MARGIN-BOTTOM: 8px">
              <table style="BACKGROUND-COLOR: #cccccc" cellspacing="1" cellpadding="0" 
      width="100%" border="0">
                <tbody>
                  <tr>
                    <td class="TopNavy" style="PADDING-RIGHT: 6px; PADDING-LEFT: 6px" 
          valign="center" align="left"><span class="TopNavy" style="PADDING-RIGHT: 6px; PADDING-LEFT: 6px"><span class="TopNavy" style="PADDING-RIGHT: 6px; PADDING-LEFT: 6px"><span style="FLOAT: left; CURSOR: hand" 
            onclick="window.parent.document.location.href='index.php?act=home';">Welcome 
                    to Control Panel!</span></span><span style="FLOAT: right"><a 
            href="http://okauchee.fearfx.com/admincp/logout.php">Logout</a> </span></span></td>
                  </tr>
                </tbody>
              </table>
            </div>
                <div class="main-area-for-section">You can control all features of your 
                  @EBC Chambers System from here.
                  <ul>
                      <li><b>Calendar Managers:</b> <br />
                        You can add new calendar manager, or 
                        delete calendar manager(s) etc. <br />
                        <br />
                      </li>
                    <li><b>Event Manager:</b> <br />
                      You can add new event, or delete event(s) 
                      etc. <br />
                      <br />
                    </li>
                  </ul>
                </div></td>
          </tr>
        </tbody>
      </table>
    </div>
  </div>
</div>

schwim · Sep 18, 2007

did you try echoing the variable, to ensure that it's not set?

My login system is session based:

session_start();

if(!session_is_registered('myusername')){

header("location:login.php");

}

If this post is correct, so is yours, so I'm thinking that yours should look more like mine

thanks,
json

[RESOLVED] help with securing admin pages

Ffearfx

Ffearfx

Ffearfx

schwim